{"record":{"id":"ceef1c0df5669a86","repo":"microsoft/aspire","slug":"az-aks-get-credentials-failed-exit-code-result-exitcode","errorCode":null,"errorMessage":"az aks get-credentials failed (exit code {result.ExitCode}): {result.StandardError}","messagePattern":"az aks get-credentials failed \\(exit code (.+?)\\): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs","lineNumber":960,"sourceCode":"    /// </summary>\n    /// <remarks>\n    /// <paramref name=\"runAzCommandAsync\"/> is injected so tests can verify that the credential\n    /// fetch is scoped to the deployment subscription without invoking the real az CLI.\n    /// </remarks>\n    internal static async Task<string> FetchKubeConfigAsync(\n        string azPath,\n        string subscriptionId,\n        string resourceGroup,\n        string clusterName,\n        Func<string, string, Task<AzCommandResult>> runAzCommandAsync)\n    {\n        var result = await runAzCommandAsync(\n            azPath,\n            BuildGetCredentialsArguments(subscriptionId, resourceGroup, clusterName)).ConfigureAwait(false);\n\n        if (result.ExitCode != 0)\n        {\n            throw new InvalidOperationException(\n                $\"az aks get-credentials failed (exit code {result.ExitCode}): {result.StandardError}\");\n        }\n\n        return result.StandardOutput;\n    }\n\n    internal static async Task<bool> AksResourceExistsAsync(\n        string azPath,\n        string subscriptionId,\n        string resourceGroup,\n        string clusterName,\n        Func<string, string, Task<AzCommandResult>> runAzCommandAsync)\n    {\n        var result = await runAzCommandAsync(\n            azPath,\n            BuildAksResourceExistsArguments(subscriptionId, resourceGroup, clusterName)).ConfigureAwait(false);\n\n        if (result.ExitCode != 0)","sourceCodeStart":942,"sourceCodeEnd":978,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure.Kubernetes/AzureKubernetesEnvironmentResource.AksPipeline.cs#L942-L978","documentation":"The pipeline runs `az aks get-credentials` (via BuildGetCredentialsArguments) to fetch raw kubeconfig content for the AKS cluster. A non-zero exit code means the az CLI could not retrieve or generate the credentials, so Aspire throws with the exit code and stderr. This is the credential-acquisition step used for cluster-scoped destroy (e.g. Helm release cleanup).","triggerScenarios":"kubeConfigContent property queried when `az aks get-credentials` fails: caller lacks Azure Kubernetes Service Cluster Admin/User role, the cluster or RG no longer exists, subscription mismatch, or az CLI/extension problems (e.g. kubernetes extension failures).","commonSituations":"RBAC removed the account's Cluster Admin role after provisioning; cluster deleted between state save and destroy; expired az credentials; concurrent runs conflicting on ~/.kube/config writes (the CLI writes kubeconfig even with -f output target when fetching).","solutions":["Grant the current identity the 'Azure Kubernetes Service Cluster Admin Role' (or Cluster User) on the cluster/RG.","Re-run `az login` and confirm `az account show` targets the subscription from [520].","Manually run `az aks get-credentials -g <rg> -n <cluster>` with the printed arguments to see the underlying error.","Confirm the cluster still exists (`az aks show`); if deleted, clear deployment state instead of forcing destroy."],"exampleFix":"// before\n# identity lacks Cluster Admin\ndestroy fails: az aks get-credentials failed (exit code 1)\n\n// after\naz role assignment create \\\n  --assignee <principal-id> \\\n  --role \"Azure Kubernetes Service Cluster Admin Role\" \\\n  --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ContainerService/managedClusters/<cluster>","handlingStrategy":"validation","validationCode":"var show = Process.Start(\"az\", $\"aks show -g {rg} -n {cluster} -o none\");\nshow.WaitForExit();\n// non-zero => missing cluster or missing permission; resolve before credential fetch","typeGuard":null,"tryCatchPattern":"try { await DestroyAsync(); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"az aks get-credentials failed\"))\n{\n    // check RBAC role assignment / re-authenticate / verify cluster exists\n}","preventionTips":["Assign Azure Kubernetes Service Cluster Admin Role to the running identity","Refresh az credentials before long-running destroy jobs","Avoid concurrent runs that contend on ~/.kube/config"],"tags":["azure","aks","az-cli","kubeconfig","rbac"],"backgroundTag":"cli-command-failed","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}